Hi Gregg, I've not seen a definitive list of attributes that are filterable but I know it is currently limited. I am also under the impression that plans exist to make this list of indexed/filterable attributes configurable by an Org administrator. I have used to the hunt and peck approach to find that these are the attributes are filterable.

As a matter of fact, the only user attributes that are currently filterable are strictly documented in the following section of our developer site: http://developer.okta.com/docs/api/resources/users.html#filters

The lastLogin attribute is unfortunately not filterable at this point.